EventID 1000, 1001 & 10 WMI Crashing

xcentric · Post by **xcentric** » Thu Jul 21, 2011 10:06 am

First, I do not believe this has anything to do with HM. I do believe this is a good place to look for answers.

Environment:
Server 2008 R2 SP1

The problem:
WMI crashes every 2 minutes when I enable a specific WMI test. The test is being executed by the local HostMonitor agent. If the test is disabled the events disappear. This happens on the hm server. This does not happen on any server running the agent.

The test:
WMI Query: select AvailableMBytes from Win32_PerfFormattedData_PerfOS_Memory
Frequency: Every 1 minute

EventID 1000:

Code: Select all

Faulting application name: wmiprvse.exe, version: 6.1.7601.17514, time stamp: 0x4ce79267
Faulting module name: ntdll.dll, version: 6.1.7601.17514, time stamp: 0x4ce7ba58
Exception code: 0xc0000374
Fault offset: 0x000ce653
Faulting process id: 0xd3c
Faulting application start time: 0x01cc47b395f386ad
Faulting application path: C:\Windows\sysWOW64\wbem\wmiprvse.exe
Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report Id: 1e8441e8-b3a7-11e0-bd23-20cf305e5fa9

EventID 10:

Code: Select all

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

EventID 1001:

Code: Select all

Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: wmiprvse.exe
P2: 6.1.7601.17514
P3: 4ce79267
P4: StackHash_c155
P5: 6.1.7601.17514
P6: 4ce7ba58
P7: c0000374
P8: 000ce653
P9: 
P10: 

Attached files:

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_wmiprvse.exe_867cdf95aec8a687c47181686da7107adbd1d096_0e4b093e

Analysis symbol: 
Rechecking for solution: 0
Report Id: 1e8441e8-b3a7-11e0-bd23-20cf305e5fa9
Report Status: 0

I have googled around. Here are some of the things I have looked into.

Checked consistency of the WMI repository. Tested OK.
Checked permissions by running a WBEMtest. Tested OK.

Can anyone offer any additional information?

Regards

KS-Soft · Post by **KS-Soft** » Thu Jul 21, 2011 11:39 am

I think Microsoft support forums much better discussion place in this case

E.g. this problem discussed here
http://social.technet.microsoft.com/For ... 80f4c953b/

There are some fixes from Microsoft
http://support.microsoft.com/kb/2280777
http://support.microsoft.com/kb/981314
but as I understand some people still experience this problem after applying patches.

Some more info regarding memory leak
http://blogs.technet.com/b/kevinholman/ ... gents.aspx

Regards
Alex

xcentric · Post by **xcentric** » Thu Jul 21, 2011 12:28 pm

Thats funny.

I have visited all those links. Even requested, received and tried to apply the patch with regard to the memory leak. However the patch claimed that the operating system was not supported.

My guess is because this was pre service pack 1. Not ruling it out though.

My research thus far has returned nothing conclusive as most with this issue.

Because I think highly of your inteligence is why I posted here.
A call to MS support will result in an expense of $250. I'm sure I can either live with this (as the query succeeds regardless) or persist further for a solution.

Thanks anyway for at least confirming that I'm on the right path.

Regards.